How are you authenticating the users to the Wireless network? Are you using PSK or 802.1x? And when you state you can identify the staff and pupil by IP Address is this because you’re statically assigning them? ... View more

That’s not really anything to do with the Meraki MX, that’s the Windows client dropping the connection. Generally, after the VPN is established, the Meraki MX knows nothing about what is happening with the client it just sees a stream of traffic to decrypt/encrypt.   I’d have a look at some of the Windows forums. A quick Google reveals you may be able to achieve this by adding the KeepRasConnections value (REG_DWORD value, set to 1) into the registry as a parameter to the RasMan service [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\R asMan\Parameters], but I don’t if this really works, works for Windows 10, or works in the switch users scenario. What this claims to do is stop a VPN connection being dropped when a user logs off.   Good luck! ... View more

If you have asymmetrical WAN links then you should hit the ‘details’ link/button next to the WAN speed in the SD-WAN & Traffic Shaping page, and you’ll be able to set the different speeds for the up and down directions. I’m not sure how the MX determines the load balancing ratio when the up and down are split out - my guess would would be it just uses the sum of the two. ... View more

And so the mystery continues...... 🤣 ... View more

@kishen32 As you only have one downlink from each MX250 to the core switch if you unplug a downlink then the VRRP messages between the MX devices will cease to flow. Since each MX is no longer receiving VRRP messages from the other each will assume the other has failed as will try to become master (or remain as master). Remember that the WAN interfaces aren't used for VRRP messages.   Looks like the only document you haven't listed is this one, https://documentation.meraki.com/MX/Networks_and_Routing/Routed_HA_Failover_Behavior. ... View more

@PavanP I just tried it on my lab network, and it doesn't work anyway. The API call returns an error,  "VLANs are not enabled for this network". So looks like the outcome is that you can't control the LAN ports on an MX if you're in Single-VLAN mode, other than through the Local Status page.... which sucks (unless anyone can come up with another way). (The obvious answer is to enable VLANs, and just configure all the ports as access ports on one VLAN - unless there was a reason for using Single-VLAN, like running OSPF).   Time to hit that 'Make a wish' button... ... View more

@PavanP So you *could* set it from the Local Admin page - although for 70 MX devices that's not ideal. Have you tried using the API to configure a MX when its in Single-VLAN mode? (https://developer.cisco.com/meraki/api-v1/#!update-network-appliance-port). It might work, it may just be that the capability isn't there in the Dashboard, but is achievable from the API (would also be a lot quicker to update the 70 MX devices, especially if they are all or mostly the same configuration). ... View more

For the WAN1 and WAN2 ports on the MX250, they're SFP+ based. There is no 1000Base-T RJ45 port for these like there is on the MX100. You'll need a MA-SFP-1GB-TX or equivalent (e.g. Cisco GLC-T= or GLC-TE=) for the WAN ports on the MX250 if you want to connect them to an RJ45 cable. ... View more

@Ozzy03260 Something to remember on the Meraki MS switches (which is different to Cisco Catalysts if you're used to them) is that you don't have to create VLAN - the switch will pass traffic on any VLAN out of the box. All you have to do is assign an access port to a VLAN. By default all trunk ports will forward all VLANs, but you can restrict (prune) this to just the VLANs you want. When you create a VLAN interface on the Meraki switch you are essentially creating a gateway (SVI in Catalyst terms) that allows that VLAN/Subnet to communicate with all others. You can then restrict communication between VLANs/Subnets (and even within a VLAN/Subnet) using ACLs. ... View more

Its being pushed now - received the update notification for 14.2 on my iOS device yesterday. ... View more

@PavanP I don't use Single-VLAN much, but just experimented and saw what you are saying; when you're in Single-VLAN mode there appears to be no option from the Dashboard to enable/disable ports or apply an access-policy - the screen that provides access to that just doesn't exist.    You could try disabling the port from the Local Status page for the MX device, that might work. Not ideal but could achieve the outcome you want if you don't need to change these often.   I'd also be making a wish to have access to these settings from the Dashboard when in Single-VLAN mode. ... View more

@viksep I'm not sure if this is the exact problem, but there is this line in the documentation, "An MX appliance must be configured in Passthrough mode when Active Directory-based content filtering is desired and the Active Directory domain controllers are located upstream or across an MPLS. Additional information on the traffic flow and the reason for this required configuration is explained below." (https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Configuring_Active_Directory_with_MX_Security_Appliances). I surmising that in your scenario the traffic to the AD domain controller is originating from a port/IP address on the MX that isn't being routed into the AutoVPN tunnel, whereas for the access points the traffic to the AD domain controller is hitting a LAN port of the MX and hence being successfully put into the AutoVPN tunnel.   If this is the case then your only option might be to stand-up a AD domain controller on the same site as the MX.    This is only a suggestion as to what is happening, would be happy for anyone else to correct me. ... View more

@CKF_Jeff You’ll likely need to change the Restricted YouTube content setting, it’s probably getting overly aggressive/not able to determine the content rating. ... View more

Support can enable the inbound firewall in routed mode, as well as enable no-nat as @PhilipDAth said.  @ArunKonkati How about using the MX in inline mode for this requirement? I haven’t thought it all through, but worth considering in this case. ... View more

Yes there is. As you've implemented the MX as a VPN Concentrator I'm assuming you are going to be using AutoVPN to connect to remote sites. So, some of the destinations will be your branch offices that you are connecting to to set up the AutoVPN, the other destination will be the Meraki Cloud and the Meraki VPN Registry. You can find the IP address and ports for these from the Dashboard, go to 'Help' (towards the top right of the Dashboard, and then 'Firewall Info'.   Generally since the traffic is all outbound initiated on the MX you can normally have your firewall rules to just allow all outbound from the MX. But I understand that sometimes there is a need to be more restrictive than that, and the above should give you all the information you require. ... View more

It is not really because of the MAC randomisation as such. Apple introduced a bug with this feature such that iOS responds to an ARP with the real MAC sometimes as well as the randomised MAC, which is what produces the error on the MX. Supposedly this will be fixed in the next iOS update. ... View more

The MR Advanced license provides for predefined Cisco Umbrella settings that can be applied and also for Adaptive Policy support. The MS Advanced license just provides Adaptive Policy support. You need to have all the devices in a network have the same license for these features to work. Also, with the MR if you apply Advanced licensing you have to use the per device licensing model. The MR and MS don’t need to have the same license - e.g. if you want the predefined Cisco Umbrella settings then you can do the advanced license just on the MR. Note that the only MS supporting Advanced Licensing is the MS390, and it currently has a lot to be desired in firmware stability and feature support. ... View more

@nikmagashi I’m assuming by Teams you are referring to Microsoft Teams. In this case I’m not sure you’re going to be prioritising traffic as you expect. Microsoft Teams uses HTTPS-based REST calls for most of its signalling and I don’t believe the “All VoIP and Video Conferencing” captures these, and it definitely can’t apply any smarts to determine the real-time streams since the signalling is encrypted. The notable exception to this is signalling to a SBC for which Microsoft Teams uses SIP, and the rules “All VoIP and Video Conferencing” should catch this.   If you use the article that @DarrenOC referenced you can determine the ports used for the various traffic types in Microsoft Team and create rules to identify the Microsoft Teams traffic based on these and then mark (I.e. assign a DSCP tag), shape and prioritise appropriately. You should only need a few rules at most, one to identify/mark audio traffic, one for video, and one for application/screen sharing.   You don’t mention anything about where this traffic is going. Is it going straight to the internet, or over a AutoVPN to another site? If it’s straight to the internet then there is little point in marking the traffic as the marking will be lost/ignored the minute the traffic hits the internet. If you’re using AutoVPN then by all means mark the traffic and the markings will be carried to the other site. But you are right to use the the priority to ensure the real-time traffic leaves the MX in-front of other traffic.   After all that is said, if you’re currently not seeing any performance issues with your Teams calls at the moment, you probably won’t get any benefit from QoS. However, if you’re having issues then it’s worth working through it. ... View more

@davidvan Out of interest are these supported as a gateway for the Meraki Sensor (MT) devices? It's not on the MT install guides, but I assume we're waiting for the documentation to catch up? ... View more

No, the vMX is only available on supported public cloud environments, to date these are Azure and AWS (and I believe also Alibaba) - GCP is on the roadmap for sometime next year. ... View more

@johnnyngena The licenses on the MX bares no relevance to the MS/MR licenses. You can have the SD-WAN Plus license on the MX and the MS/MR can be Enterprise licenses. The MXs, however, do all need to have the same license, i.e. SD-WAN Plus if that's your chosen license.   Check the features of the licenses and make sure you are purchasing the most cost effective licenses for what you are trying to achieve. You can see the features here, https://documentation.meraki.com/General_Administration/Licensing/Meraki_MX_Security_and_SD-WAN_Licensing. ... View more

@RyanMiller I agree with you that if you are doing 1:many NAT and NATing a port on a specific IP address to an internal IP address for device, then when that device's internal IP address responds from that port it should be NATed back to the IP address that is defined in the 1:many. That seems like it would be the logical behaviour and I would raise this with Meraki support (it may be a bug) - if you already have I'd love to know their response. (The 1:many NAT documentation make no mention of the behaviour of the return traffic).   In your Zoom scenario - I just glanced through the Zoom document - why can't you use the Port Forwarding capability of the MX using its primary IP address instead of the 1:many? Is it just a preference not to, or am I not understanding something in your environment. ... View more

Yep MU-MIMO should mean we can make better use of those 4x4 and 8x8 access points. But I’ve seen articles that suggest the benefit of it when devices are in motion is limited, as is when the devices are too close together - both because it’s hard to create the ‘beam’ that the technology relies on. So I guess time and real world experience is going to show us whether it’s any good. ... View more

Meant to be on the price list 3 Nov (although haven’t checked, but I’m assuming this is where TaniaSanchez saw them) with support for Azure, AWS and Alibaba (support for GCP in the pipeline... sometime next year) ... View more